SSL connection failed connecting to GMX

[km660000]

I have gone through down loading the new cert file and even putting in an exclusion. Nothing works.

Made sure all versions were current.

Using POP3 - pop.gmx.com
SSL/TLS
Port 995

Link to GMX server info:
https://support.gmx.com/pop-imap/pop3/serverdata.html

This had been working up to a week or so ago... Nothing seems to work right now.

[mjs]

Please post your Error information by clicking on the yellow exclamation in the lower-right corner of the POP Peeper main interface, click on the "Copy" button and post the information in this topic with a right-click and select "Paste". Doing this is helps us to know more about what kind of problem you are having by providing additional information beyond what you have posted.

Without this Error information it is difficult to know what to tell you, but you could try setting your "Server type" (edit account/General tab) to pop.mail.com and see if this helps.

[km660000]

--- Version ---
OS: Windows 10 (x64)
POP Peeper: 4.4.2.0
Webmail: 4.4.4.0
SSL: 1.0.2.11
IMAP: 4.4.2.0
SendMail: 4.4.2.0
Profile Picture: 4.3.0.0 (disabled)
AntiJunk: 4.4.0.0 (disabled)
Spell Checker: 4.4.0.0 (disabled)
Web of Trust: 4.4.0.0 (disabled)

--- Error ---
GMX [0: POP3] ['pop.gmx.com' (995) SSL: 1] [ClientSend: '' (0) SSL: 0] [Consec: 122]
- SSL connection failed

[Jeff]

That's a general SSL error and not related to SSL certificates; meaning the cacert.pem and exclusions aren't relevant -- the file won't hurt but you may want to remove the exclusion (or wait until gmx is working).

It looks like your settings are correct (and I've tested with my own gmx.com account so nothing wrong with the server), so there's probably something else involved. Typical reasons are:
- You're behind a corporate firewall that blocks external access (sometimes, specifically on port 995 for security reasons)
- You're using security software (e.g. AntiVirus with real-time email scanning) installed on your computer that isn't configured properly

What I would suggest you try is to switch your gmx account to use IMAP with STARTTLS.

[km660000]

THanks. I will try that and also try from home and let you know.

[mjs]

THanks. I will try that and also try from home and let you know.

So then you are trying this at two different locations, I am assuming that you are currently getting these errors at "work" perhaps (which is critical information). In this case, most likely the issue is because of a "corporate firewall" as Jeff mentioned and you will not have this problem at home. If "IMAP" does not work at your work-place you could then try setting your account(s) to use Webmail ("Server type" = "mail.com" ONLY at work to avoid work-place security) - again, keep in mind that IMAP and/or POP3 should not be a problem at home). Correction: I am mistaken in regards to using the "Webmail" protocol ("mail.com" Server type) for GMX accounts as I was not formerly aware that it is no longer supported for actual mail.com email addresses. (hopefully there are no firewall restrictions using IMAP/POP3 at your work-place )

[lwc]

After it broke in v4.4 and got fixed in v4.4.2 (or even 4.4.1) it stopped working again as soon as I upgraded to v4.5 (which contained a new and much larger cacert-full.pem):

SSL connection failed (certificate failed: self signed certificate in certificate chain (19))

[Jeff]

Ok, sorry about that -- I found what the problem was It will be fixed in the next release.

In the meantime, there's an easy solution -- just rename cacert-full.pem to cacert.pem
-> edit: found in ...\POP Peeper\SslCerts\
-> e.g. C:\Program Files (x86)\POP Peeper\SslCerts\

The logic in v4.5 is that cacert-full.pem will only be used on an as-needed basis; unfortunately, imap.gmx.net didn't get caught as the "needed" criteria even though it should have.


Out of curiosity -- did you do a clean uninstall of POP Peeper before you installed v4.5? Otherwise, your previous cacert.pem file should still have existed and been used successfully...

[lwc]

Next release as in hopefully 4.5.1 and not 5.0?

It sounds best to still use it on an as-needed basis. So since eventually it's just a text file, can you tell me how to manually add a listing for GMX?

Yes, I clean uninstalled. I like running apps in a portable way, so I keep just the INI, etc. and replace everything else using the portable version.
BTW, this reminds me I wish the Plus Pack had a portable version.

[Jeff]

I don't know if there will be another release before v5.0. As much as I regret this oversight, I don't think it affects too many people (it does not affect gmx.com; and only German residents can use gmx.net; further, most people who were affected in v4.4x probably still have the cacert.pem file that fixed it). So it depends on whether other people report a similar problem or whether other issues pop up.

You should be able to strip down the cacert-full.pem file and use just the section for gmx.net in the cacert.pem. Ah, I can't attach the .pem file in the forum, so I'll just post the text below. cacert.pem is just a text file, so create the file and post the text into it. I haven't tested if this works or not (sorry, I'm in kind of a rush), but it should work as long as there are no other dependencies necessary.

There is a portable version of the Plus Pack (by which, I assume, you mean a zip file). You have to use the email method to access it though on the product page (ie. it's one of the links you'll receive in the email reply):
https://www.esumsoft.com/productrequest/

Code: Select all

Deutsche Telekom Root CA 2 | (gmx.net)
==========================
-----BEGIN CERTIFICATE-----
MIIDnzCCAoegAwIBAgIBJjANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJERTEcMBoGA1UEChMT
RGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxlU2VjIFRydXN0IENlbnRlcjEjMCEG
A1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290IENBIDIwHhcNOTkwNzA5MTIxMTAwWhcNMTkwNzA5
MjM1OTAwWjBxMQswCQYDVQQGEwJERTEcMBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0G
A1UECxMWVC1UZWxlU2VjIFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBS
b290IENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrC6M14IspFLEUha88EOQ5
bzVdSq7d6mGNlUn0b2SjGmBmpKlAIoTZ1KXleJMOaAGtuU1cOs7TuKhCQN/Po7qCWWqSG6wcmtoI
KyUn+WkjR/Hg6yx6m/UTAtB+NHzCnjwAWav12gz1MjwrrFDa1sPeg5TKqAyZMg4ISFZbavva4VhY
AUlfckE8FQYBjl2tqriTtM2e66foai1SNNs671x1Udrb8zH57nGYMsRUFUQM+ZtV7a3fGAigo4aK
Se5TBY8ZTNXeWHmb0mocQqvF1afPaA+W5OFhmHZhyJF81j4A4pFQh+GdCuatl9Idxjp9y7zaAzTV
jlsB9WoHtxa2bkp/AgMBAAGjQjBAMB0GA1UdDgQWBBQxw3kbuvVT1xfgiXotF2wKsyudMzAPBgNV
HRMECDAGAQH/AgEFMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAlGRZrTlk5ynr
E/5aw4sTV8gEJPB0d8Bg42f76Ymmg7+Wgnxu1MM9756AbrsptJh6sTtU6zkXR34ajgv8HzFZMQSy
zhfzLMdiNlXiItiJVbSYSKpk+tYcNthEeFpaIzpXl/V6ME+un2pMSyuOoAPjPuCp1NJ70rOo4nI8
rZ7/gFnkm0W09juwzTkZmDLl6iFhkOQxIY40sfcvNUqFENrnijchvllj4PKFiDFT1FQUhXB59C4G
dyd1Lx+4ivn+xbrYNuSD7Odlt79jWvNGr4GUN9RBjNYj1h7P9WgbRGOiWrqnNVmh5XAFmw4jV5mU
Cm26OWMohpLzGITY+9HPBVZkVw==
-----END CERTIFICATE-----

[lwc]

The 1 listing custom made cacert.pem worked perfectly. I didn't even need to restart PP!
But whether it'll be v4.5.1 or v5, please don't forget to fix this part, who knows if other listings fail too:

The logic in v4.5 is that cacert-full.pem will only be used on an as-needed basis; unfortunately, imap.gmx.net didn't get caught as the "needed" criteria even though it should have.